Privacy Policy
The short version
- We collect only what we need to reply to you, show you a demo, and run the services you sign up for.
- We never sell your personal data, and we do not use it to advertise anything except our own services.
- When we build a store or POS for a business, that business owns its customer data. We only handle it on the business's instructions.
- Card details are handled by payment providers. We never see or store full card numbers.
- You can ask to see, correct or delete your data at any time, and you can complain to Kenya's Office of the Data Protection Commissioner.
1. Who we are
Bayaanly Digital Solutions ("Bayaanly", "we", "us") builds and runs online stores, point-of-sale (POS) systems and online advertising for businesses. Our office is at BBS Mall (Business Bay Square), Eastleigh, Nairobi, Kenya, and we serve businesses across Kenya.
This policy explains how we handle personal data under the Data Protection Act, 2019 of Kenya and its regulations. It covers our website bayaanly.com, our WhatsApp, phone and email contact, our demos, and the services we provide to clients.
2. Our two roles
The law gives different duties to a data controller (who decides why and how data is used) and a data processor (who handles data on someone else's behalf). We act in both roles:
| Whose data | Our role | Which rules apply |
|---|---|---|
| People who visit our website, contact us, book a demo, or become our clients (and their staff) | Data controller | This whole policy |
| Customers of the businesses we build stores and POS systems for (for example, someone who orders from a shop's website) | Data processor for that business | The business's own privacy policy, plus section 7 of this policy |
If you bought something from a business that uses Bayaanly, that business is responsible for your data. Please contact them first. If you contact us instead, we will pass your request to them and help them answer it.
3. What we collect
Information you give us
- Contact details: your name, phone or WhatsApp number, email address, business name and location.
- Enquiry details: what you sell, how many branches you have, the plan you are interested in, and anything you write in messages, calls or forms.
- Demo materials: photos of your products and shop, your price lists, logo and product descriptions. We photograph products, not people. If a person appears in a photo by accident, we crop or blur them or ask their permission.
- Client details: the names and contact details of owners and staff we work with, staff names and logins for the POS, your M-Pesa till or paybill number, business registration and KRA PIN where needed for invoices, and the details needed to connect your payment and advertising accounts.
- Billing records: invoices, payments, M-Pesa or bank transaction references, and the signed agreement.
Information collected automatically
- Technical data: when you visit our website, our hosting provider and the services that deliver our fonts and page code automatically receive your IP address, browser type, device type and the time of your visit. This is needed to show you the page and keep it secure.
- Language choice: our website remembers the language you pick on your own device (see section 13).
Our website does not currently use analytics, advertising pixels or tracking cookies. If we add them, we will update this policy first and ask for your consent where the law requires it.
Information from others
Sometimes we receive your details from someone who refers you to us, or from public sources such as a business directory or your public business page, so that we can contact you about our services. We tell you where we got your details when we first contact you.
We do not ask for sensitive personal data, such as health, religious or biometric data. Please do not send it to us.
4. How and why we use it
We only use personal data where the law allows it. The table shows what we use data for and the legal basis for each use.
| What we do | Legal basis |
|---|---|
| Reply to your messages and give you prices and information | Steps you asked for before a contract; our legitimate interest in answering enquiries |
| Build your free demo | Your request and consent (you can ask us to delete the demo at any time) |
| Set up and run your website, POS and ads, train your staff and give support | Performance of our contract with you |
| Send invoices, collect payments and keep accounting and tax records | Contract, and legal obligations under Kenyan tax law |
| Send you updates, tips and offers about our services | Your consent, which you can withdraw at any time (section 12) |
| Show a client's website and business name in our portfolio | Our agreement with the client, who can object in writing at any time |
| Keep our systems secure, prevent fraud and fix problems | Our legitimate interest in running a safe service |
| Respond to lawful requests from courts, regulators or the police | Legal obligation |
We do not make decisions about you using only automated processing.
6. Data stored outside Kenya
Some of our service providers, including WhatsApp, Google, our hosting providers and the advertising platforms, store data on servers outside Kenya, for example in the European Union or the United States. When data leaves Kenya, we only use providers that apply strong security and data protection safeguards, and we transfer data only where the Data Protection Act allows it, for example where the transfer is needed to perform our contract with you or where appropriate safeguards are in place. You can ask us for more information about these safeguards.
7. Data in our clients' stores and POS
When we build and run an online store or POS for a business, that business is the data controller and we are its data processor. This data may include customer names, phone numbers, delivery addresses, order history, payment confirmations, sales records and staff logins.
- We use this data only to provide the services the business has signed up for, and only on its instructions.
- The business owns its customer and sales data. We do not use it for our own purposes, and we do not share one client's data with another client.
- Everyone at Bayaanly who can access client data must keep it confidential.
- If we learn of a data breach affecting a client's data, we will tell the client within 48 hours of becoming aware of it, and help it notify the Data Commissioner and its customers where required.
- When a client's agreement ends, we give the client an export of its products, customers and sales history, as set out in our service agreement, and then delete the remaining copies from our systems within 90 days, unless the law requires us to keep them.
- Each client is responsible for having its own privacy policy for its customers and a lawful reason for the data it collects. We can help clients prepare one.
8. Payments
Card and PayPal payments are processed by regulated payment providers. Bayaanly never sees or stores full card numbers or PayPal passwords. M-Pesa and Airtel Money payments go directly to the till, paybill or account of the business being paid. For a client's store, the money goes straight to the client, not through us. We keep payment confirmations and transaction references only, to match orders and invoices.
9. How long we keep data
| Data | How long |
|---|---|
| Enquiries from people who do not become clients | Up to 12 months after our last contact |
| Demo photos and materials if you do not sign up | Up to 6 months, or sooner if you ask us to delete them |
| Client contact details and project files | For the length of the agreement, then up to 12 months to handle any follow-up |
| Invoices, payment records and signed agreements | At least 5 years after the transaction, as Kenyan tax law requires |
| Client store and POS data | For the length of the agreement, then deleted within 90 days of handover (section 7) |
| Website technical logs | Short periods set by our hosting provider, usually no more than a few weeks |
When we no longer need data, we delete it or make it anonymous.
10. How we protect data
- Our websites and the stores we build use encrypted connections (HTTPS/SSL).
- Access to client systems is limited to the people who need it, with strong passwords and two-step verification where the service offers it.
- POS staff logins can be removed as soon as a staff member leaves.
- We keep backups and update our systems to fix security problems.
No system is completely secure. If a breach of personal data we control happens and is likely to put people at risk, we will notify the Office of the Data Protection Commissioner within 72 hours of becoming aware of it, and tell the people affected as soon as we reasonably can, with advice on how to protect themselves.
11. Your rights
Under the Data Protection Act, 2019 you have the right to:
- Be informed about how your personal data is used (this policy).
- Access the personal data we hold about you and get a copy.
- Correct data that is wrong, out of date or incomplete.
- Delete data that is false, misleading, or that we no longer have a right to keep.
- Object to us using your data, including for direct marketing.
- Withdraw your consent at any time, where we rely on consent. This does not affect anything we did before you withdrew it.
- Data portability: receive data you gave us in a common format, or have it sent to another provider.
- Not be subject to decisions based only on automated processing.
To use any of these rights, message us on WhatsApp or email us (section 17). We may ask you to confirm your identity before we act. We aim to reply within 7 days and will always reply within the time the law allows. We do not charge for these requests unless they are clearly unfounded or excessive.
12. Marketing messages
We only send marketing messages by WhatsApp, SMS or email to people who have agreed to receive them, or to clients about services similar to the ones they already use. Every message tells you how to stop. Reply STOP or tell us on WhatsApp, and we will stop within 48 hours.
14. Children
Our services are for businesses and adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.
15. Complaints
If you are unhappy with how we have handled your personal data, please tell us first and we will try to put it right. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC), Kenya's data protection regulator, at any time: www.odpc.go.ke.
16. Changes to this policy
We may update this policy when our services or the law change. The effective date at the top shows when it was last updated. If we make important changes, we will tell our clients by WhatsApp or email before they take effect.
17. Contact us
For any question about privacy or your personal data, contact our data protection contact: